VMware vCenter Under Attack: CVE-2026-59310 Enables Persistent Access

Active Exploitation Targeting vCenter Server

QUIRSO has detected active exploitation of CVE-2026-59310, a critical directory traversal vulnerability in Broadcom VMware vCenter Server. The activity was identified on August 12, 2026, during an incident response engagement.

The vulnerability carries a CVSS score of 9.8. An attacker able to reach the system over the network could exploit it to execute arbitrary code.

Broadcom released patches at the end of the previous month and subsequently disclosed the flaw publicly. The exact affected versions are unknown.

Compromised systems began contacting attacker-controlled infrastructure on August 3, five days after the vulnerability was publicly disclosed. QUIRSO identified up to 361 unique victim IP addresses across 47 countries, with the highest concentrations in Germany, the United States, Turkey, Iran, and France.

From Exploitation to Persistent Access

The observed attack chain is consistent with initial access obtained through CVE-2026-59310. The attackers then installed a malicious cron job designed to execute activities automatically on the system.

They subsequently used reverse_ssh, an open-source tool that establishes outbound SSH connections to attacker-controlled endpoints. This mechanism can bypass some controls designed to block suspicious inbound connections.

Together, these techniques allowed the attackers to maintain persistent access to the compromised appliance. The presence of reverse_ssh alone does not prove an intrusion; it becomes a priority indicator when associated with unauthorized installations, anomalous cron jobs, and unexpected outbound connections.

The operator has not been attributed. The activity is considered potentially consistent with a suspected APT actor.

Another VMware Flaw Targeted by Scanners

Defused Cyber observed an increase in VMware vCenter scanning consistent with attempts to exploit CVE-2026-59309, which is also rated CVSS 9.8.

Honeypots recorded version fingerprinting through POST /sdk/, RetrieveServiceContent requests, and analysis of the SAML SSO flow at /websso.

CVE-2026-59309 is described in advisory VMSA-2026-0006 as an authentication-bypass vulnerability in vmdir, potentially allowing access controls to be bypassed. However, there is insufficient evidence to link these scans to the infrastructure or group responsible for the attacks observed with CVE-2026-59310.

Previous incidents include campaigns attributed to Chinese threat actors, including UNC5174, which targeted VMware Tools and VMware vCenter. In April 2025, SentinelOne also described the Chinese PurpleHaze cluster. Its GoReShell backdoor includes reverse_ssh functionality, but this does not establish a connection to the current activity.

Checks to Perform on Appliances

Administrators should:

• apply Broadcom patches for CVE-2026-59310;
• assess exposure to CVE-2026-59309 by following VMSA-2026-0006;
• search for recently added or modified cron jobs;
• identify unauthorized installations of reverse_ssh;
• analyze outbound connections to unknown domains or endpoints;
• check for anomalous execution on vCenter appliances;
• monitor requests to POST /sdk/, RetrieveServiceContent, and /websso.

A vulnerable appliance associated with these indicators should be treated as a potential successful compromise, not merely an attempted exploit.